{"id":874637,"url":"https://alion.io/job/nabucasa-product-security-compliance-engineer","title":"Product Security & Compliance Engineer","company":{"id":682271,"name":"Nabu Casa","domain":"nabucasa.com","url":"https://alion.io/company/nabucasa","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Madrid, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":81800,"max":102700,"currency":"GBP","period":"year","gross":null,"usd_annual":136004},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"GDPR","optional":false},{"name":"Home Assistant","optional":false},{"name":"Matter","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Wi-Fi","optional":false},{"name":"GitHub","optional":true}],"status":"live","first_seen_at":"2026-08-26T08:58:30Z","employer_posted_date":"2026-08-26","last_verified_at":"2026-10-19T04:11:32Z","board_verified":true,"closed_at":null,"days_open":53,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":53},"description":"About Nabu Casa\nNabu Casa, Inc was founded in 2018 by the founders of bothHome Assistant, the open source home automation platform, andHome Assistant OS, the operating system that turns your device into a smart home hub powered by Home Assistant. These projects have seen an immense growth and have helped shape DIY home automation communities around the world.\nAfter being involved in the Internet of Things industry for many years, we realized that there is a need for a cloud service that aims to put users, their privacy and their data first. Such a cloud can only be built as an extension to a platform that does the same: Home Assistant.\nWith Nabu Casa we are building this cloud service and we’re calling it Home Assistant Cloud.\nWe are a profitable company with no external investors. Our funding comes directly from users who subscribe to Home Assistant Cloud and purchase Home Assistant hardware, ensuring our only stakeholders are our employees and our users. We also support other open-source projects, including those focused on hardware, standards, and voice technology.\nThe role\nNabu Casa is looking for a full-time Product Security & Compliance Engineer to help ensure that our connected hardware and cloud services are secure, resilient, and compliant with the regulatory requirements that apply to them.\nHome Assistant is one of the world's largest open-source smart home platforms, and Nabu Casa supports its development while also bringing connected hardware and cloud services to users around the world. As our product portfolio grows, so does the importance of building security and regulatory compliance into our products from the start.\nThis is a deliberately hybrid role combining hands-on product security engineering with cybersecurity compliance. You will work across connected devices, firmware, networking, and cloud services: building threat models, performing security validation, managing vulnerability and software-supply-chain risks, and turning that technical work into the evidence required for product conformity.\nYou will also help Nabu Casa navigate evolving product cybersecurity requirements such as the EU Radio Equipment Directive (RED), EN 18031, and the Cyber Resilience Act (CRA).\nWe don't expect you to arrive as an expert in every security and regulatory domain. We are looking for someone with strong technical security foundations who is comfortable learning, interpreting requirements, taking ownership, and working across engineering and compliance boundaries.\nWhat you are going to do\nOwn the cybersecurity aspects of regulatory compliance for Nabu Casa's connected hardware products, including RED cybersecurity requirements and EN 18031.\n\nHelp prepare Nabu Casa's products and processes for the EU Cyber Resilience Act (CRA), including vulnerability handling, security updates, SBOMs, support periods, and incident reporting.\n\nCreate and maintain architecture and data-flow diagrams for connected products and services.\n\nPerform threat modeling and translate identified risks into security requirements and controls.\n\nPerform hands-on product security validation, including vulnerability and dependency scanning, SAST/DAST, firmware analysis, network and service exposure assessment, and targeted penetration testing.\n\nGenerate and maintain Software Bills of Materials (SBOMs) and help monitor software dependencies for known vulnerabilities.\n\nValidate security mechanisms such as authentication, secure boot, and signed software or firmware updates.\n\nTranslate security assessments and test results into structured compliance evidence, technical documentation, conformity assessments, and Declarations of Conformity.\n\nWork closely with hardware, firmware, cloud, and product teams to ensure security and compliance requirements are considered early in product development.\n\nCoordinate with our ODMs and external certification bodies where required, while owning Nabu Casa's cybersecurity evidence internally.\n\nWork with the Open Home Foundation to ensure security information, vulnerability handling, and software-related documentation flow effectively between open-source projects and Nabu Casa's commercial products.\n\nKeep track of product conformity status, security support periods, regulatory deadlines, and changes that may require reassessment.\n\nProvide privacy-by-design input for significant changes to our cloud services when needed.\n\nWhat you need to have\nStrong hands-on technical experience in at least one of the following areas: embedded/firmware security, network security, application security, or cloud security.\n\nExperience creating architecture or data-flow diagrams and performing threat modeling for real products or systems.\n\nPractical experience with security testing and tooling, such as vulnerability scanning, SAST/DAST, software composition analysis, SBOM tooling, network security testing, firmware analysis, or penetration testing.\n\nExperience working with connected products, IoT, embedded systems, firmware, or systems that combine hardware and software/cloud services.\n\nExperience translating technical security findings into structured documentation, evidence, risk assessments, or compliance requirements.\n\nKnowledge of product cybersecurity standards or regulations, such as EN 18031, RED cybersecurity requirements, the Cyber Resilience Act, ETSI EN 303 645, IEC 62443, or comparable frameworks.\n\nAbility to independently interpret technical requirements, identify gaps, and work with engineering teams to implement appropriate solutions.\n\nComfortable working autonomously across multiple technical domains in a distributed organization.\n\nStrong written and verbal communication skills.\n\nFluent in English, both written and spoken.\n\nIt would be great if you also have\nPersonal experience using Home Assistant and familiarity with the smart home ecosystem.\n\nExperience taking a connected or radio-enabled product through CE/RED conformity or FCC equipment authorization.\n\nDirect experience with EN 18031 and RED Article 3.3(d), (e), and (f).\n\nPractical experience preparing products or organizations for the EU Cyber Resilience Act.\n\nHands-on firmware security experience with constrained or embedded devices.\n\nExperience with secure boot and signed OTA update mechanisms.\n\nExperience integrating security testing into CI/CD or secure software development processes.\n\nFamiliarity with standards and frameworks such as ETSI EN 303 645, IEC 62443, ISO/IEC 27001, OWASP ASVS/MASVS, or NIST SSDF.\n\nFamiliarity with GDPR and privacy-by-design principles for cloud or software products.\n\nBroader product-compliance exposure, such as RoHS, REACH, WEEE, GPSR, or FCC.\n\nExperience working with open-source projects or communities.\n\nRelevant security or privacy certifications such as OSCP, GIAC, CISSP, CIPP/E, or CIPT.\n\nWhat we offer\nNabu Casa is a fully remote organization that uses Remote to employ people from all over the world. You will be a normal salaried employee in your country.\nThis is a full-time position for 40 hours per week. Because we are a fully remote company, there is no fixed schedule. For the purpose of team communication, we do try to ensure at least 3 hours of overlap in the workday.\nCore to the establishment of Nabu Casa was the well-being of the people building the future of the smart home. We will provide all the benefits required by the country you reside in. However, we also want to make sure all our employees, regardless of country of origin, get at least a minimal set of benefits, including:\nFive weeks (twenty-five days) of paid time off.\n\nFourteen days of paid sick leave if your country/laws treat them as unpaid.\n\nSix weeks of paid and six weeks of unpaid parental leave to be used in the first year after birth. We will provide the missing days if your country/laws do not provide such compensation.\n\nA budget for your work hardware once you start. After three years, you may keep this equipment for personal use.\n\nAn annual smart home budget to ensure you keep up-to-date with the latest smart home offerings.\n\nA 50% contribution to your internet connection fee at your home workspace.\n\nOne day every two weeks to work on your personal projects.\n\nIf you are currently working on Home Assistant-related side projects, you can spend work time maintaining them.\n\nWhen first offering a position to a new team member, Nabu Casa aims to provide a total compensation package that matches the 75th percentile for the new hire's role, seniority, and local market rates.\nUK: £81,800-£102,700\nHungary: HUF 21,000,000-27,600,000\nNetherlands: €87,400-€107,300\nSpain: €66,700-€86,200\nPortugal: €58,000-€72,000\nGreece: €50,100-€64,900\nItaly: €71,400-€92,400\nRomania: RON 306,000-373,000\nThese figures may be adjusted based on experience, qualifications, and work hours.\nAbout Us\nNabu Casa funds the development of Home Assistant and other projects at the Open Home Foundation. Nabu Casa is best known as the organization driving the development of Home Assistant, the world's largest free and open-source smart home platform. More than two million households benefit from its home automation capabilities. Powered by a worldwide community of open-source developers, GitHub ranked it the most active open-source project in the world in 2024.\nWe were initially founded to ensure that the development of Home Assistant would remain sustainable as it kept growing, but over time we have grown to support more open home initiatives. In 2024, the Open Home Foundation was formed to protect these open-source projects and ensure they thrive into the future.\nNabu Casa is a commercial partner of the foundation, and our principles are aligned with a joint commitment to privacy, choice, and sustainability in the smart home. These are the values that we put at the heart of every decision we make. They're woven into our architecture, licensing, community, and everything else.\nNabu Casa is profitable, has no external investors, and our only funding comes from people subscribing to Home Assistant Cloud and buying Home Assistant hardware. That means the only stakeholders we have to concern ourselves with are our employees and our users.\nOther Open Home Foundation projects and collaborations supported by Nabu Casa include:\nOpen hardware tools (e.g., ESPHome, ESP Web Tools)\n\nOpen standards (e.g., Python Matter Server, Z-Wave JS, ZigPy, BTHome, Improv Wi-Fi)\n\nOpen voice (e.g., Rhasspy, Wyoming Protocol, Piper)\n\nMusic Assistant\n\nThe recruitment process\nApply for the role\n\nOur team will review your application with the hiring manager\n\nHR Screening - 30 minutes\n\nTechnical Case\n\nTeam Interview\n\nFinal interview with our Founder\n\nOffer\n\nJoin our team!","description_format":"text","description_chars":10665,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Parental leave"],"hiring_locations":[{"name":"Germany","iso":"DE","kind":"region"},{"name":"France","iso":"FR","kind":"region"},{"name":"United Kingdom","iso":"GB","kind":"country"},{"name":"Austria","iso":"AT","kind":"region"},{"name":"Belgium","iso":"BE","kind":"country"},{"name":"Bulgaria","iso":"BG","kind":"region"},{"name":"Croatia","iso":"HR","kind":"region"},{"name":"Czech Republic","iso":"CZ","kind":"country"},{"name":"Denmark","iso":"DK","kind":"region"},{"name":"Finland","iso":"FI","kind":"region"},{"name":"Hungary","iso":"HU","kind":"country"},{"name":"Ireland","iso":"IE","kind":"country"},{"name":"Italy","iso":"IT","kind":"country"},{"name":"Netherlands","iso":"NL","kind":"country"},{"name":"Norway","iso":"NO","kind":"region"},{"name":"Poland","iso":"PL","kind":"country"},{"name":"Romania","iso":"RO","kind":"country"},{"name":"Spain","iso":"ES","kind":"country"},{"name":"Sweden","iso":"SE","kind":"region"},{"name":"Switzerland","iso":"CH","kind":"region"},{"name":"Estonia","iso":"EE","kind":"region"},{"name":"Greece","iso":"GR","kind":"country"},{"name":"Iceland","iso":"IS","kind":"region"},{"name":"Latvia","iso":"LV","kind":"country"},{"name":"Liechtenstein","iso":"LI","kind":"region"},{"name":"Lithuania","iso":"LT","kind":"country"},{"name":"Luxembourg","iso":"LU","kind":"region"},{"name":"Malta","iso":"MT","kind":"region"},{"name":"Portugal","iso":"PT","kind":"country"},{"name":"Slovakia","iso":"SK","kind":"region"},{"name":"Slovenia","iso":"SI","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Smart Home Devices","Application Security","Consumer & Utility Software"],"lifecycle":[{"event":"open","at":"2026-09-13T19:29:25Z"}],"visa":[],"liveness":{"score":27,"band":"fade","label":"Fading","p_open":1,"p_active":0.362,"p_room":0.75,"age_days":53,"expected_fill_days":59,"reasons":["conf:1","win:late"],"computed_at":"2026-10-19T05:45:15Z"},"pay":{"stated_usd_annual":136004,"is_top_pay":false},"html_url":"https://alion.io/job/nabucasa-product-security-compliance-engineer","json_url":"https://alion.io/job/nabucasa-product-security-compliance-engineer.json","meta":{"generated_at":"2026-10-19T07:38:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4986,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":682271},"rest":"https://alion.io/mcp/rest/get_company?id=682271"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnabucasa-product-security-compliance-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnabucasa-product-security-compliance-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnabucasa-product-security-compliance-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nabucasa-product-security-compliance-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnabucasa-product-security-compliance-engineer"}]}